CVE-2026-80075: Windows 10 21H2 Privilege Escalation Flaw

CVE-2026-80075 Overview

CVE-2026-80075 is a heap-based buffer overflow [CWE-122] in the Windows Work Folders component. An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows 10 and Windows 11 systems. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Successful exploitation grants the attacker high impact against confidentiality, integrity, and availability. The vulnerability affects supported branches of Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) across x86, x64, and ARM64 architectures. No public exploit or in-the-wild activity has been reported.

Critical Impact
Local privilege escalation to SYSTEM through memory corruption in the Work Folders service on all currently supported Windows client editions.

Affected Products

Microsoft Windows 10 21H2 (x86, x64, ARM64)
Microsoft Windows 10 22H2 and Windows 11 24H2 (x64, ARM64)
Microsoft Windows 11 25H2 and 26H1 (x64, ARM64)

Discovery Timeline

2026-09-08 - CVE-2026-80075 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80075

Vulnerability Analysis

The flaw resides in the Windows Work Folders service, which synchronizes user files between client devices and enterprise file servers. A heap-based buffer overflow occurs when the service processes attacker-controlled input without sufficient bounds validation. An authorized local user can craft input that causes memory beyond an allocated heap buffer to be overwritten.

Because the Work Folders service runs with elevated privileges, corrupting adjacent heap structures can be leveraged to hijack execution flow. Successful exploitation yields code execution in a higher-privileged context, typically SYSTEM. The attack requires local access and low privileges, but no user interaction.

Root Cause

The issue is classified under [CWE-122] Heap-based Buffer Overflow. The Work Folders service fails to correctly validate the length or structure of input written into a heap allocation. Microsoft has not published implementation-level details in the advisory.

Attack Vector

Exploitation requires an authenticated session on the target host. The attacker interacts with the Work Folders service through a local interface, delivers a malformed payload, and triggers the overflow. No network reachability or victim interaction is required. Public proof-of-concept code is not available. See the Microsoft Security Update Guide for vendor guidance.

Detection Methods for CVE-2026-80075

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries associated with the Work Folders service (WorkFoldersSvc).
Creation of new local administrator accounts or privileged tokens following Work Folders service activity.
Suspicious child processes spawned by the Work Folders service host process.

Detection Strategies

Monitor process creation events where svchost.exe hosting WorkFoldersSvc launches command interpreters such as cmd.exe or powershell.exe.
Alert on integrity-level transitions from Medium to System within a short time window on endpoints with Work Folders enabled.
Correlate Application and System event log crashes referencing Work Folders with subsequent privilege changes.

Monitoring Recommendations

Enable command-line and process auditing (Event ID 4688) across Windows 10 and Windows 11 endpoints.
Track Work Folders configuration changes and service restarts through Windows Event Forwarding.
Baseline expected Work Folders sync activity to surface anomalous local IPC or file operations.

How to Mitigate CVE-2026-80075

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-80075 as soon as it is available in your update ring.
Inventory endpoints with the Work Folders client feature enabled and prioritize patching those hosts.
Restrict interactive and remote logon rights to reduce the population of users capable of triggering the flaw.

Patch Information

Microsoft has issued guidance through the Microsoft Security Update Guide. Administrators should deploy the corresponding cumulative update for each affected build: Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, Windows 11 25H2, and Windows 11 26H1 across x86, x64, and ARM64 architectures.

Workarounds

Disable the Work Folders client feature on systems that do not require file synchronization with enterprise servers.
Stop and disable the WorkFoldersSvc service where operationally acceptable until the patch is applied.
Enforce least-privilege policies and application allowlisting to limit unauthorized local binaries from interacting with the service.

bash

# Configuration example: disable the Work Folders service where not required
sc.exe stop WorkFoldersSvc
sc.exe config WorkFoldersSvc start= disabled

# Remove the Work Folders client feature (Windows 10/11)
DISM /Online /Disable-Feature /FeatureName:WorkFolders-Client /NoRestart